@bongos/core 1.21.175 → 1.21.177

package/tests/autonomy_daily_checks.mjs

@@ -0,0 +1,201 @@
+// tests/autonomy_daily_checks.mjs — the server's daily checks run once a day, file
+// each distinct finding once, and never record "could not check" as clean
+// (task 1004878).
+//
+// DB-free and network-free: the run ledger, the roster, npm and the idea inbox are
+// all injected. The one thing these tests exist to stop is the failure every one of
+// these routines already had — declared daily, run never — so the scheduling half
+// (isDue against the ledger, not the boot) is pinned as hard as the filing half.
+//
+// Run:  node --test tests/autonomy_daily_checks.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const dc = require('../modules/autonomy/pollers/daily-checks.js');
+const { SERVER_ROUTINES, DAY_MS, WEEK_MS } = require('../modules/autonomy/server-schedule.js');
+const rt = require('../modules/autonomy/pollers/routine-timers.js');
+
+const NOW = Date.parse('2026-10-26T12:00:00Z');
+const hoursAgo = (h) => new Date(NOW - h * 3600_000).toISOString();
+const LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+
+// A fake ledger: rows newest-first, plus a list of what got recorded.
+function ledger(rows = []) {
+  const recorded = [];
+  return {
+    recorded,
+    db: {
+      readAutonomyRuns: async () => rows,
+      recordAutonomyRun: async (r) => { recorded.push(r); return {}; },
+      readRankRoster: async () => [
+        { id: 1, github_login: 'ok', rank: 'archon', status: 'active' },
+        { id: 2, github_login: 'old', rank: 'ephor', status: 'inactive' },
+      ],
+    },
+  };
+}
+const quiet = { log: () => {}, error: () => {} };
+const capturing = () => {
+  const filed = [];
+  return { filed, captureIdea: async (i) => { filed.push(i); return { id: 42 }; } };
+};
+
+// ------------------------------------------------------------- the schedule table
+
+test('the daily poller runs exactly the server-schedule rows that name it', () => {
+  assert.deepEqual(dc.ROUTINES, SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine));
+  assert.deepEqual(dc.ROUTINES.sort(), ['dep-audit-nightly', 'rank-roles-audit']);
+});
+
+test('peer-vote-tally takes its period from the same table (weekly)', () => {
+  assert.equal(rt.PEER_VOTE_INTERVAL_MS, WEEK_MS);
+});
+
+// ------------------------------------------------------------------ isDue
+
+test('due when it has never run', () => {
+  assert.equal(dc.isDue([], 'rank-roles-audit', NOW), true);
+});
+
+test('not due 20 hours after the last run, due 23.5 hours after — daily, not per boot', () => {
+  assert.equal(dc.isDue([{ created_at: hoursAgo(20) }], 'rank-roles-audit', NOW), false);
+  assert.equal(dc.isDue([{ created_at: hoursAgo(23.5) }], 'rank-roles-audit', NOW), true);
+  assert.equal(dc.DUE_SLACK_MS < DAY_MS / 24, true, 'slack must stay under one hourly tick or runs drift');
+});
+
+test('an ERROR row counts as a run too, so a broken check is retried daily, not hourly', async () => {
+  const L = ledger([{ decision: 'no-go', reason: 'error: x', created_at: hoursAgo(2) }]);
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, ...quiet });
+  assert.equal(out.skipped, 'not_due');
+  assert.equal(L.recorded.length, 0);
+});
+
+// --------------------------------------------------------------- filing
+
+test('a finding is filed as one idea and the run records its fingerprint', async () => {
+  const L = ledger();
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+  assert.equal(C.filed.length, 1);
+  assert.match(C.filed[0].title, /^\[rank-roles\] 1 builder/);
+  assert.match(C.filed[0].bodyMd, /builder 2 \(old\) rank=ephor status=inactive/);
+  assert.equal(C.filed[0].kind, 'bug');
+  assert.equal(L.recorded[0].decision, 'go');
+  assert.match(L.recorded[0].reason, /^findings n=1 fp=[0-9a-f]{12} idea=42$/);
+});
+
+test('the SAME finding the next day is recorded unchanged and NOT filed again', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([{ decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+  assert.match(L.recorded[0].reason, /unchanged$/);
+});
+
+test('an error between two identical findings does not cause a duplicate filing', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([
+    { decision: 'no-go', reason: 'error: db blip', created_at: hoursAgo(24) },
+    { decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(48) },
+  ]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+});
+
+test('a finding that comes back after a clean day is filed again', async () => {
+  const L = ledger([{ decision: 'go', reason: 'clean', created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+});
+
+test('the fingerprint ignores order and changes when the set changes', () => {
+  assert.equal(dc.fingerprint(['a', 'b']), dc.fingerprint(['b', 'a']));
+  assert.notEqual(dc.fingerprint(['a']), dc.fingerprint(['a', 'b']));
+});
+
+test('a clean run files nothing and records clean', async () => {
+  const L = ledger();
+  L.db.readRankRoster = async () => [{ id: 1, rank: 'archon' }];
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'clean');
+  assert.equal(C.filed.length, 0);
+  assert.deepEqual(L.recorded[0], { routine: 'rank-roles-audit', decision: 'go', reason: 'clean' });
+});
+
+test('no idea inbox (ideas module off) is recorded as undelivered, and retried next time', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: 'not a function', ...quiet });
+  assert.equal(out.outcome, 'undelivered');
+  assert.equal(L.recorded[0].decision, 'no-go', 'a no-go row is never read as delivered');
+  assert.equal(dc.lastFiledFingerprint(L.recorded.map((r) => ({ ...r }))), null);
+});
+
+test('a capture that throws is undelivered, never a crash', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', {
+    db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: async () => { throw { code: 'BAD_KIND' }; }, ...quiet,
+  });
+  assert.equal(out.outcome, 'undelivered');
+  assert.match(L.recorded[0].reason, /undelivered: BAD_KIND/);
+});
+
+// ------------------------------------------------------- could not check ≠ clean
+
+test('npm missing is an ERROR row, not clean', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i', npmAudit: async () => ({ error: 'npm not found' }), ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.deepEqual(L.recorded[0], { routine: 'dep-audit-nightly', decision: 'no-go', reason: 'error: npm not found' });
+});
+
+test("npm's own JSON error (no lockfile) is an ERROR row, not clean", async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i',
+    npmAudit: async () => ({ stdout: JSON.stringify({ error: { code: 'ENOLOCK', summary: 'This command requires an existing lockfile.' } }), stderr: '' }),
+    ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.match(L.recorded[0].reason, /lockfile/);
+});
+
+test('dep-audit audits the cwd it is handed and files high/critical findings only', async () => {
+  const L = ledger();
+  const C = capturing();
+  let auditedIn = null;
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/srv/instance', captureIdea: C.captureIdea, ...quiet,
+    npmAudit: async (cwd) => {
+      auditedIn = cwd;
+      return { stdout: JSON.stringify({ vulnerabilities: {
+        bad: { severity: 'critical', via: [{ severity: 'critical', title: 'RCE', url: 'https://x/1', source: 1 }], fixAvailable: true },
+        meh: { severity: 'moderate', via: [], fixAvailable: true },
+      } }), stderr: '' };
+    },
+  });
+  assert.equal(auditedIn, '/srv/instance');
+  assert.equal(out.outcome, 'filed');
+  assert.match(C.filed[0].title, /^\[dep-audit\] 1 high\/critical vulnerability in/);
+  assert.match(C.filed[0].bodyMd, /\*\*bad\*\* \(critical\) — RCE/);
+  assert.doesNotMatch(C.filed[0].bodyMd, /meh/);
+});
+
+// --------------------------------------------------------------- the tick
+
+test('an unreachable database is a quiet skip for every routine (a builder laptop)', async () => {
+  const db = { readAutonomyRuns: async () => { throw new Error('connect ENOENT /var/run/postgresql'); } };
+  const out = await dc.tick({ db, ...quiet });
+  assert.deepEqual(out.map((r) => r.skipped), dc.ROUTINES.map(() => 'db_unreachable'));
+});

package/tests/autonomy_digest.mjs

@@ -12,7 +12,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { buildDigest, renderDigest, windowsFromGauge, humanDuration } = require('../modules/autonomy/digest.js');
-const cli = require('../scripts/gds/autobongos-digest.js');
+const cli = require('../scripts/bongos/autobongos-digest.js');
 
 const T0 = Date.parse('2026-09-19T02:00:00.000Z');
 const at = (m) => new Date(T0 + m * 60000).toISOString();

package/tests/autonomy_gate.mjs

@@ -5,7 +5,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
-const { decide, autofixAllowed, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD } = require('../scripts/gds/autonomy-gate.js');
+const { decide, autofixAllowed, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD } = require('../scripts/bongos/autonomy-gate.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {

package/tests/autonomy_gauge.mjs

@@ -16,8 +16,8 @@ import path from 'node:path';
 const require = createRequire(import.meta.url);
 const { decideCapacity, readGauge, reserveFor, weeklyPace, whenPaceAllows, cfg } =
   require('../modules/autonomy/gauge.js');
-const statusline = require('../scripts/gds/autonomy-gauge-statusline.js');
-const cli = require('../scripts/gds/autonomy-gauge.js');
+const statusline = require('../scripts/bongos/autonomy-gauge-statusline.js');
+const cli = require('../scripts/bongos/autonomy-gauge.js');
 
 // Run fn with env vars set, always restoring them.
 function withEnv(vars, fn) {

package/tests/autonomy_runner_identity.mjs

@@ -22,7 +22,7 @@ const req = createRequire(import.meta.url);
 const express = req('express');
 const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
 const health = req(path.join(ROOT, 'modules/autonomy/runner-health.js'));
-const runner = req(path.join(ROOT, 'scripts/gds/autobongos-run.js'));
+const runner = req(path.join(ROOT, 'scripts/bongos/autobongos-run.js'));
 
 const NOW = Date.parse('2026-10-01T12:00:00.000Z');
 const agoS = (s) => new Date(NOW - s * 1000).toISOString();

package/tests/backfill_sessions.mjs

@@ -16,9 +16,9 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const bf = require('../scripts/gds/backfill-sessions.js');
-const { encodeProjectPath } = require('../scripts/gds/ship.js');
-const { looksLikeGraderTranscript } = require('../scripts/gds/session-cost.js');
+const bf = require('../scripts/bongos/backfill-sessions.js');
+const { encodeProjectPath } = require('../scripts/bongos/ship.js');
+const { looksLikeGraderTranscript } = require('../scripts/bongos/session-cost.js');
 
 let passed = 0;
 let failed = 0;
@@ -39,7 +39,7 @@ const toolUse = (name, input) => ({ type: 'assistant', message: { content: [{ ty
 const toolResult = (text) => ({ type: 'user', message: { content: [{ type: 'tool_result', content: text }] } });
 
 test('extracts a shipped task from a ship.js invocation', () => {
-  const ids = bf.extractTaskIds([toolUse('Bash', { command: 'node scripts/gds/ship.js 681 --regrade' })]);
+  const ids = bf.extractTaskIds([toolUse('Bash', { command: 'node scripts/bongos/ship.js 681 --regrade' })]);
   assert.deepEqual(ids, [681]);
 });
 
@@ -79,7 +79,7 @@ test('dedupes and sorts across a multi-task session', () => {
   const entries = [
     asst('Claimed #284. Dispatching.'),
     asst('Claimed #270. Dispatching.'),
-    toolUse('Bash', { command: 'node scripts/gds/ship.js 284' }), // repeat of 284
+    toolUse('Bash', { command: 'node scripts/bongos/ship.js 284' }), // repeat of 284
     asst('Claimed #299.'),
   ];
   assert.deepEqual(bf.extractTaskIds(entries), [270, 284, 299]);
@@ -181,7 +181,7 @@ test('grader detection matches a NEW worker persona, not just the known four', (
 
 test('extracts a 7-digit task id from a ship.js invocation', () => {
   // {1,4} matched nothing on a live instance, so no modern session could ever pay.
-  const ids = bf.extractTaskIds([toolUse('Bash', { command: 'node scripts/gds/ship.js 1002471' })]);
+  const ids = bf.extractTaskIds([toolUse('Bash', { command: 'node scripts/bongos/ship.js 1002471' })]);
   assert.deepEqual(ids, [1002471]);
 });
 
@@ -194,7 +194,7 @@ test('extracts 7-digit ids from claim/release/Claimed markers', () => {
 test('7-digit ids survive extractTaskIds (the n < 10000 clamp is gone)', () => {
   // Widening TASK_MARKERS alone was not enough: the clamp dropped them again.
   const entries = [
-    toolUse('Bash', { command: 'node scripts/gds/ship.js 1002471' }),
+    toolUse('Bash', { command: 'node scripts/bongos/ship.js 1002471' }),
     asst('Claimed #284.'), // legacy 3-digit ids must still work
   ];
   assert.deepEqual(bf.extractTaskIds(entries), [284, 1002471]);
@@ -208,7 +208,7 @@ test('grader worker transcripts are detectable and would otherwise be paid', ()
   const file = path.join(dir, 'aaaaaaaa-0000-0000-0000-000000000000.jsonl');
   const graderPrompt =
     'You are the **Narc** — a specialist adversarial subagent for this project. ' +
-    'Review the diff shipped by node scripts/gds/ship.js 1002471 --summary "x".';
+    'Review the diff shipped by node scripts/bongos/ship.js 1002471 --summary "x".';
   try {
     fs.writeFileSync(file, JSON.stringify({ type: 'user', message: { role: 'user', content: graderPrompt } }) + '\n');
     assert.ok(looksLikeGraderTranscript(file), 'the grader worker prompt must be detected');

package/tests/backfill_subagent_rewards.mjs

@@ -17,7 +17,7 @@ import { makeRunner } from './helpers.mjs';
 const require = createRequire(import.meta.url);
 const {
   CLASSES, DEDUP_FIX_AT, classifySession, buildBackfillPlan, renderReport,
-} = require('../scripts/gds/backfill-subagent-rewards.js');
+} = require('../scripts/bongos/backfill-subagent-rewards.js');
 const {
   computeSessionTokenReward, sessionTrueCostUsd, awardSessionTokenReward,
 } = require('../modules/economy/credits.js');

package/tests/backfill_task_rewards.mjs

@@ -1,6 +1,6 @@
 // tests/backfill_task_rewards.mjs
 //
-// Unit tests for the PURE logic of scripts/gds/backfill-task-rewards.js
+// Unit tests for the PURE logic of scripts/bongos/backfill-task-rewards.js
 // (task 1672, ADR 0097) — the retroactive 0-reward drachmae backfill tool.
 //
 // Covered (NO DB, NO network):
@@ -25,7 +25,7 @@ const {
   computeTaskReward,
   netForBuilder,
   planForBuilder,
-} = require('../scripts/gds/backfill-task-rewards.js');
+} = require('../scripts/bongos/backfill-task-rewards.js');
 
 const { test, summary } = makeRunner();
 

package/tests/backlog_review.mjs

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const br = require('../scripts/gds/backlog-review.js');
+const br = require('../scripts/bongos/backlog-review.js');
 
 const task = (over = {}) => ({
   id: 1, status: 'backlog', kind: 'feature', title: 't', created_at: '2026-01-01T00:00:00Z',
@@ -169,9 +169,9 @@ test('the API limit the script asks for is within the route cap of 1000', () =>
 
 // --- the skill names a command that exists and runs -----------------------
 
-test('SKILL.md names scripts/gds/backlog-review.js and that file loads and partitions', () => {
+test('SKILL.md names scripts/bongos/backlog-review.js and that file loads and partitions', () => {
   const skill = fs.readFileSync(path.join(ROOT, '.claude', 'skills', 'backlog-review', 'SKILL.md'), 'utf8');
-  assert.match(skill, /scripts\/gds\/backlog-review\.js/, 'the skill must name the script it runs');
+  assert.match(skill, /scripts\/(?:gds|bongos)\/backlog-review\.js/, 'the skill must name the script it runs');
   // Executed, not paraphrased: the module the prose points at really answers.
   const p = br.partitionBacklog([task({ id: 99 })]);
   assert.deepEqual(p.nod.map((t) => t.id), [99]);

package/tests/baseline_staleness.mjs

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const bs = require(path.join(ROOT, 'scripts', 'gds', 'baseline-staleness.js'));
+const bs = require(path.join(ROOT, 'scripts', 'bongos', 'baseline-staleness.js'));
 
 const NOW = Date.parse('2026-08-24T00:00:00Z');
 const daysAgo = (n) => new Date(NOW - n * 86400000).toISOString();
@@ -193,7 +193,7 @@ test('LIVE: --update-baselines preserves the floors instead of overwriting them'
   // ({_comment: '<hardcoded>', metrics}), so one refresh silently destroyed both
   // the accumulated comment and every floor — and a lost floor turns a finished
   // metric into permanent weekly noise with its reason gone from the repo.
-  const rat = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+  const rat = require(path.join(ROOT, 'scripts', 'bongos', 'fitness-ratchets.js'));
   const before = JSON.parse(fs.readFileSync(rat.BASELINE_PATH, 'utf8'));
   assert.ok(before.floors && Object.keys(before.floors).length > 0, 'the shipped file must carry floors');
   // Simulate the writer's preserve step on a temp copy rather than running the

package/tests/bfg.mjs

@@ -18,7 +18,6 @@ const require = createRequire(import.meta.url);
 const bfg = require('../modules/sessions/bfg.js'); // carved → modules/sessions/ (BV1.R82 / ADR 0093 §1)
 const auth = require('../src/module-api'); // doorway: memory-module routes capture api.requireBuilder, so the stub must patch the doorway (BV1.R72 / ADR 0091)
 const memory = require('../modules/memory/memory.js');
-const db = require('../src/bongos/db.js');
 
 let passed = 0;
 let failed = 0;
@@ -230,7 +229,7 @@ const orig = {
   requireBfgPrincipal: auth.requireBfgPrincipal,
   listMemoryFiles: memory.listMemoryFiles,
   fetchMemoryFile: memory.fetchMemoryFile,
-  insertAuditLog: db.insertAuditLog,
+  insertAuditLog: auth.insertAuditLog,
 };
 const fixture = { session: { id: 9, system_role: 'bfg', rank: 'xenos' }, storeCalls: [], auditCalls: [], auditShouldThrow: false };
 
@@ -248,7 +247,10 @@ memory.fetchMemoryFile = async function (builderId, p) {
   if (p === 'missing.md') return null;
   return { path: p, content: 'hi', sha256: 'a', byte_len: 2, mtime: null, updated_at: 'now', created_at: 'now' };
 };
-db.insertAuditLog = async function (row) {
+// The route reaches the audit insert through the module doorway (`db = api` in
+// modules/memory/routes/memory.js), so the stub goes on the doorway — stubbing
+// src/bongos/db.js left the REAL insert in place, which needs Postgres (task 1004865).
+auth.insertAuditLog = async function (row) {
   await new Promise((r) => setImmediate(r));
   if (fixture.auditShouldThrow) throw new Error('audit down');
   fixture.auditCalls.push(row);
@@ -258,6 +260,10 @@ db.insertAuditLog = async function (row) {
 const express = require('express');
 const app = express();
 app.use(express.json());
+// Install res.fail() as the real app does — the routes answer every error through it
+// (task 1004865; the tests/memory_isolation.mjs idiom).
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+app.use(attachFail);
 app.use('/api/gds', buildMemoryRouter());
 const server = http.createServer(app);
 await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
@@ -311,7 +317,7 @@ try {
     const res = await fetch(`${base}/memory/bfg/builders/42/file?path=notes.md`);
     assert.equal(res.status, 500);
     const body = await res.json();
-    assert.equal(body.error, 'audit_failed');
+    assert.equal(body.error.code, 'audit_failed');
     assert.ok(!('content' in body));
   });
 } finally {
@@ -320,7 +326,7 @@ try {
   auth.requireBfgPrincipal = orig.requireBfgPrincipal;
   memory.listMemoryFiles = orig.listMemoryFiles;
   memory.fetchMemoryFile = orig.fetchMemoryFile;
-  db.insertAuditLog = orig.insertAuditLog;
+  auth.insertAuditLog = orig.insertAuditLog;
 }
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/bfg_write.mjs

@@ -28,7 +28,7 @@ import url from 'node:url';
 const require = createRequire(import.meta.url);
 const auth = require('../src/module-api'); // doorway: memory-module routes capture api.requireBuilder, so the stub must patch the doorway (BV1.R72 / ADR 0091)
 const memory = require('../modules/memory/memory.js');
-const db = require('../src/bongos/db.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
 let passed = 0;
 let failed = 0;
@@ -54,6 +54,9 @@ function runGate(builder) {
     status(c) { code = c; return this; },
     json(b) { body = b; return this; },
   };
+  // The real gate answers through res.fail(), which the app installs on every response
+  // (attachFail). Decorate the fake the same way rather than re-implementing it (task 1004865).
+  attachFail(req, res, () => {});
   auth.requireBfgPrincipal(req, res, () => { nexted = true; });
   return { nexted, code, body };
 }
@@ -68,7 +71,7 @@ await t('an ARCHON token is REJECTED (403 not_bfg_principal) — the ADR 0026 §
   const r = runGate({ id: 1, rank: 'archon', system_role: null });
   assert.equal(r.nexted, false, 'an archon must NOT reach the write path');
   assert.equal(r.code, 403);
-  assert.equal(r.body.error, 'not_bfg_principal');
+  assert.equal(r.body.error.code, 'not_bfg_principal');
 });
 
 await t('a metic and a xenos are both rejected', () => {
@@ -214,7 +217,7 @@ const orig = {
   bfgWriteMemoryFile: memory.bfgWriteMemoryFile,
   storeMemoryFilesBatch: memory.storeMemoryFilesBatch,
   deleteMemoryFile: memory.deleteMemoryFile,
-  getBuilderById: db.getBuilderById,
+  getBuilderById: auth.getBuilderById,
   BFG_WRITE_ENABLED: process.env.BFG_WRITE_ENABLED,
 };
 
@@ -252,7 +255,10 @@ memory.deleteMemoryFile = async function stubDelete(builderId, p) {
   fixture.deleteCalls.push({ builderId, path: p });
   return p === 'bfg/gone.md' ? 0 : 1; // 0 = nothing to delete
 };
-db.getBuilderById = async function stubGet(id) {
+// The route reaches the builder lookup through the module doorway (`db = api` in
+// modules/memory/routes/memory.js), so the stub goes on the doorway — stubbing
+// src/bongos/db.js left the REAL lookup in place, which needs Postgres (task 1004865).
+auth.getBuilderById = async function stubGet(id) {
   if (Number(id) === fixture.target.id) return fixture.target;
   if (Number(id) === 999) return null;
   if (Number(id) === 500) return { id: 500, system_role: 'bfg' }; // another system principal
@@ -262,6 +268,9 @@ db.getBuilderById = async function stubGet(id) {
 const express = require('express');
 const app = express();
 app.use(express.json());
+// Install res.fail() as the real app does — the route answers every error through it,
+// in the { error: { code, message } } envelope (task 1004865).
+app.use(attachFail);
 app.use('/api/gds', buildMemoryRouter());
 const server = http.createServer(app);
 await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
@@ -307,7 +316,7 @@ try {
     fixture.session = { id: 9, github_login: 'bfg-system', system_role: 'bfg', rank: 'xenos' };
     const res = await post('/memory/builders/42/bfg-write', VALID);
     assert.equal(res.status, 503);
-    assert.equal((await res.json()).error, 'bfg_write_disabled');
+    assert.equal((await res.json()).error.code, 'bfg_write_disabled');
     assert.equal(fixture.writeCalls.length, 0);
     process.env.BFG_WRITE_ENABLED = 'true';
   });
@@ -317,7 +326,7 @@ try {
     fixture.session = { id: 9, github_login: 'bfg-system', system_role: 'bfg', rank: 'xenos' };
     const res = await post('/memory/builders/9/bfg-write', VALID);
     assert.equal(res.status, 400);
-    assert.equal((await res.json()).error, 'bfg_cannot_write_self');
+    assert.equal((await res.json()).error.code, 'bfg_cannot_write_self');
     assert.equal(fixture.writeCalls.length, 0);
   });
 
@@ -325,7 +334,7 @@ try {
     reset();
     const res = await post('/memory/builders/500/bfg-write', VALID);
     assert.equal(res.status, 400);
-    assert.equal((await res.json()).error, 'target_is_system_principal');
+    assert.equal((await res.json()).error.code, 'target_is_system_principal');
     assert.equal(fixture.writeCalls.length, 0);
   });
 
@@ -340,7 +349,7 @@ try {
     reset();
     const res = await post('/memory/builders/42/bfg-write', { ...VALID, kind: 'nightmare' });
     assert.equal(res.status, 400);
-    assert.equal((await res.json()).error, 'bad_bfg_input');
+    assert.equal((await res.json()).error.code, 'bad_bfg_input');
     assert.equal(fixture.writeCalls.length, 0);
   });
 
@@ -378,7 +387,7 @@ try {
     reset();
     const res = await post('/memory/builders/42/bfg-write', { kind: 'correction', slug: 'x', body_md: 'b', rationale: 'r', karma_delta: 5 });
     assert.equal(res.status, 400);
-    assert.equal((await res.json()).error, 'bad_karma_delta');
+    assert.equal((await res.json()).error.code, 'bad_karma_delta');
     assert.equal(fixture.writeCalls.length, 0);
   });
 
@@ -386,7 +395,7 @@ try {
     reset();
     const res = await post('/memory/builders/42/bfg-write', { ...VALID, karma_delta: -1 });
     assert.equal(res.status, 400);
-    assert.equal((await res.json()).error, 'karma_delta_not_allowed');
+    assert.equal((await res.json()).error.code, 'karma_delta_not_allowed');
     assert.equal(fixture.writeCalls.length, 0);
   });
 
@@ -414,7 +423,7 @@ try {
   memory.bfgWriteMemoryFile = orig.bfgWriteMemoryFile;
   memory.storeMemoryFilesBatch = orig.storeMemoryFilesBatch;
   memory.deleteMemoryFile = orig.deleteMemoryFile;
-  db.getBuilderById = orig.getBuilderById;
+  auth.getBuilderById = orig.getBuilderById;
   if (orig.BFG_WRITE_ENABLED === undefined) delete process.env.BFG_WRITE_ENABLED;
   else process.env.BFG_WRITE_ENABLED = orig.BFG_WRITE_ENABLED;
 }

package/tests/blockers_hall.mjs

@@ -166,13 +166,23 @@ test('filing has no rank gate — any signed-in builder sees the File button, mi
     'the file form is mounted unconditionally, not behind an isReviewer()/rank check');
 });
 
-test('resolve/link controls mirror the SAME metic-or-archon floor the idea triage panel already uses — no floor of its own', () => {
-  assert.match(BLOCKERS_JS_SRC, /isReviewer\s*=\s*function\s*\(\)\s*\{\s*return viewer\.rank === 'metic' \|\| viewer\.rank === 'archon';\s*\}/);
-  assert.match(TASK_DETAIL_SRC, /kind === 'blocker' && r\.status === 'open' && \(rank === 'metic' \|\| rank === 'archon'\)/);
+// task 1004824: the routes gate on requirePermission('blocker.review'), which a
+// government can move off the metic floor, so BOTH surfaces mirror that atom
+// off /me.permissions — never a rank guess — and an unreadable map hides.
+test('resolve/link controls mirror the SAME blocker.review permission the routes check — no floor of their own', () => {
+  const ROUTES = readFileSync(join(ROOT, 'modules/ideas/routes/blockers.js'), 'utf8');
+  assert.match(ROUTES, /'\/blockers\/:id\/resolve', api\.requireBuilder, api\.requirePermission\('blocker\.review'\)/,
+    'the wall the page mirrors is still the blocker.review atom');
+  assert.match(BLOCKERS_JS_SRC, /isReviewer = function \(\) \{ return viewer\.mayReview === true; \}/);
+  assert.match(BLOCKERS_JS_SRC, /viewer = \{ mayReview: perms\['blocker\.review'\] === true \}/);
+  assert.match(TASK_DETAIL_SRC, /kind === 'blocker' && r\.status === 'open' && perms && perms\['blocker\.review'\] === true/);
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /viewer\.rank === 'metic'/, 'no rank guess left behind');
+  const ME = readFileSync(join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
+  assert.match(ME, /NAV_PERMISSION_ATOMS = Object\.freeze\(\[[^\]]*'blocker\.review'/, '/me must report the atom or the controls hide for everyone');
 });
 
 test('a 403 on resolve/link/file-link renders HONEST copy, not a silent no-op (the done-when, verbatim)', () => {
-  assert.match(BLOCKERS_JS_SRC, /err && err\.status === 403.*You need Metic\+ access to do that\./);
+  assert.match(BLOCKERS_JS_SRC, /err && err\.status === 403.*You can’t resolve or link blockers here\./);
   // The file-then-link flow specifically: a filer without blocker.review still
   // gets told the filing succeeded AND that linking needs a Metic+ — never a
   // swallowed catch that leaves them guessing whether anything happened.